Lecture 64: VPC Endpoint Service
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：08:28
- 来源：Udemy Lecture 50324621
- Slide 数量：4
- 画面切换：00:44、03:02、07:35
扫描说明
逐条检查了 Udemy 页面中的 111 条 Transcript cue，并对全长 08:28 的视频画面进行扫描。依据标题、Endpoint Service 核心架构、可用区注意事项和本地目标架构的画面切换，共划分出 4 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. VPC Endpoint Service 导论
时间范围：00:00–00:44
总结 / Summary
中文
VPC 端点服务（VPC Endpoint Service）用于把提供方 VPC 内自建的服务通过私有链路（PrivateLink）发布给其他使用者 VPC。它解决了自建应用无需公网暴露即可被客户私有访问的问题。
English
A VPC Endpoint Service publishes a customer-owned service from a provider VPC to other consumer VPCs through AWS PrivateLink. It lets customers access the application privately without exposing it to the public Internet.
Transcript
00:00 Okay, now let's look at how to access VPC endpoint service using the VPC endpoint and private link.
00:07 So we haven't talked specifically about VPC endpoint service as of now.
00:11 But essentially it means that you are hosting your services inside VPC.
00:17 And you are exposing that to the VPC through the VPC endpoint and private link.
00:23 Right.
00:24 So in the last exercise we accessed AWS service using VPC endpoint.
00:29 But what if you have your own services and you want to expose that privately to the other customers.
00:34 And that's where VPC endpoint service comes into the picture.
00:38 So this is very much like a provider VPC which is say owned by you.
2. Endpoint Service 的提供方与使用者架构
时间范围：00:44–03:02
总结 / Summary
中文
提供方把运行在 EC2 或容器上的服务放在网络负载均衡器（Network Load Balancer, NLB）之后，并将 NLB 发布为 VPC Endpoint Service；每个使用者 VPC 创建自己的接口端点（Interface Endpoint）连接该服务。相比 VPC 对等连接（VPC Peering），此模型不要求 CIDR 不重叠，也不会暴露广泛的端到端网络连通性，且能扩展到不同 AWS 账户中的数千个 VPC。AWS Marketplace 与 AWS Partner Network 的 SaaS 服务常使用该模式。
English
The provider places services running on EC2 or containers behind a Network Load Balancer (NLB) and publishes the NLB as a VPC Endpoint Service. Each consumer VPC creates its own Interface Endpoint to connect. Unlike VPC Peering, the model supports overlapping CIDRs, avoids broad end-to-end network connectivity, and scales to thousands of VPCs across AWS accounts. SaaS offerings in AWS Marketplace and the AWS Partner Network commonly use this pattern.
Transcript
00:44 And now say your different customers wants to access that service privately.
00:49 Now historically if you have to do something like this, then you would have to pair your provider VPC
00:55 with all those consumer VPCs.
00:57 And then all those challenges about overlapping Cidrs and having end to end, you know, broader connectivity
01:04 comes into the picture, which is what you don't want.
01:07 That's where what you do.
01:08 Rather, you create your service inside a VPC using network load balancer, and then you expose that
01:14 network load balancer as a VPC endpoint service.
01:18 And then in each consumer VPC, you create the VPC endpoint for this particular endpoint service.
01:25 So it's a more secure and scalable way to expose services to thousands of VPCs.
01:30 As against, you know, having VPC peering.
01:33 There are a number of connection limits, but here you can expose your services to thousands of consumer
01:39 VPCs.
01:39 And those VPCs can be across different AWS accounts.
01:43 And we will see some examples of that.
01:46 Then another benefit is, of course you do not need VPC peering or internet gateways or Nat gateways
01:52 in the consumer VPC to access these services.
01:55 And it requires network load balancer in the provider VPC, something like this.
02:00 And then you will have your actual services running on EC2 instances or on the containers, but they
02:06 should be behind network load balancer.
02:09 And then you expose this network load balancer as a VPC endpoint service.
02:15 So once you do that then you create the VPC endpoint in the consumer VPCs.
02:21 And all these VPCs can access your VPC.
02:25 And as I said these VPCs can be in different AWS accounts right.
02:32 And this is how typically you will also access the SAS services which are available on AWS marketplace
02:38 or in AWS Partner Network VPCs.
02:43 So this is kind of a scalable, secure way to access the services which are deployed inside VPC.
02:51 So that's basically is VPC endpoint service.
02:54 And now let's talk about a few important things that you should know about the VPC endpoint services.
02:59 And then we will do another exercise.
3. Availability Zone 对齐与跨账户 AZ ID
时间范围：03:02–07:35
总结 / Summary
中文
提供方应让 NLB 和后端目标跨多个可用区（Availability Zones, AZs）部署，使用者也应在对应 AZ 创建 Endpoint ENI，并通过可用区专用 DNS（zonal DNS）让流量留在本地 AZ，以避免跨可用区数据传输费（cross-AZ data transfer charge）。区域 DNS（Regional DNS）可能轮询到其他 AZ 的 ENI。为提高故障容错能力，可为 NLB 启用跨区负载均衡（cross-zone load balancing）。跨 AWS 账户时，相同的 AZ 名称可能代表不同物理 AZ，因此必须按全账户一致的可用区 ID（Availability Zone ID, AZ ID）对齐，而不能只比较 us-east-1a 等名称。
English
The provider should deploy the NLB and backend targets across multiple Availability Zones, while consumers create endpoint ENIs in corresponding AZs and use Zonal DNS so traffic remains local and avoids cross-AZ transfer charges. Regional DNS may round-robin to ENIs in other AZs. Cross-zone load balancing on the NLB can improve failure handling. Across AWS accounts, the same AZ name may map to different physical zones, so designs must align by globally consistent Availability Zone IDs rather than labels such as us-east-1a.
Transcript
03:02 So important thing is you need to understand the AZ consideration.
03:06 So because you are using the network load balancer in the service provider VPC, you know that you will
03:12 typically create that across multiple availability zones because your targets were actually services
03:18 are running should be in different AZS for high availability.
03:22 Now if you do that when you create VPC endpoints, they should also be created in different AZS, right.
03:29 Something like this.
03:30 Now in the previous lecture we briefly talked about that here in the consumer VPC.
03:36 The instances can access this endpoint service using the local Eni into their subnet or in that AZ.
03:43 But they can also access through another AZ.
03:46 Eni.
03:47 But in that case there will be cross AZ data transfer charges.
03:51 So try to make sure that in the consumer VPC you align the availability zone with the service provider
03:57 VPC, right?
03:59 So service provider VPC should have target across multiple AZS.
04:03 And then VPC endpoint in service.
04:05 Consumer VPC should also be created in corresponding AZS.
04:10 In consumer VPC application should use zone specific DNS so that traffic remains in that AC only, and
04:18 otherwise, if using the regional endpoint, then DNS will resolve to the Eni IPS of this VPC endpoint.
04:25 Dennis.
04:26 In round robin fashion.
04:28 So you might not keep the traffic in the same AC, and there could be additional charge for inter AC
04:34 data transfer charges.
04:36 And finally, to make this solution perfectly highly available for the network load balancer, you should
04:41 also enable the cross zone load balancing so that if one of the AC is down, network load balancer can
04:49 send traffic to the target in another AC.
04:52 Now this is all about the load balancer feature.
04:54 But again, in this context you should also consider that.
04:59 Okay.
05:00 And just one last thing about the AC consideration, which probably not many people know is that if
05:07 the service provider VPC and the service consumer VPCs are say in different AWS account, then the AZ
05:16 in one account may not be the same as in another account.
05:21 Now let's try to understand that.
05:23 So imagine that in service provider VPC you are using two availability zone.
05:27 And if it's a North Virginia region then the availability zones will be say US East one A and US East
05:34 one B.
05:35 Now if in the same region you create the service consumer VPC but in different AWS account, then of
05:42 course you will also try to create VPC endpoint in the same AZ that is US East one and US east one B.
05:50 But in reality that might be US East one C and US East one A for this particular AWS account.
06:00 Which means the A-Z names in different AWS account may not point to the same AZ which is otherwise there.
06:09 Now, this might sound a little confusing, but probably the reason AWS did this is because otherwise
06:15 all the customers will typically use first A-Z to launch their resources, and that might basically
06:22 overwhelm one of the easy only and rest of the ashes will be unused.
06:27 So what AWS did?
06:28 They probably randomly pointed the AZ names to different AZ in different AWS account.
06:35 So how do you handle that now?
06:37 Now for that, you need to consider rather easy IDs which are same across different AWS account.
06:44 So always look at the easy IDs.
06:47 So if in Service Provider account you are launching your network load balancer and resources in one
06:53 of the AZ, check its AC ID and then use same AZ IDs for the consumer VPC endpoints as well.
07:03 Now once you do that, your traffic remains in the same AZ and then you don't pay for, you know, cross
07:09 AZ data transfer charges.
07:11 So the point is, even if you are using the same AZ in different AWS account, you may still have the
07:16 cross AZ data transfer charges because AZS are not actually same.
07:21 So I hope it is clear.
07:22 And just last one more point about the VPC endpoint service is that if you are talking about this service
07:28 provider VPC, this targets behind the network load balancer need not be in the same VPC, right?
4. 以 On-premises 服务作为 NLB Target
时间范围：07:35–08:28
总结 / Summary
中文
NLB 后端目标不必位于提供方 VPC。提供方可把本地网络（on-premises network）中的服务 IP 注册为 NLB 目标，并通过虚拟专用网络（VPN）或专线（AWS Direct Connect）连接 VPC 与本地环境；使用者仍通过 Interface Endpoint 和 PrivateLink 访问同一个 Endpoint Service。
English
The backend targets of the NLB do not have to reside in the provider VPC. The provider can register IP addresses for services in an on-premises network and connect that network to the VPC through VPN or AWS Direct Connect. Consumers still access the same Endpoint Service through Interface Endpoints and PrivateLink.
Transcript
07:35 Which means this target can also be somewhere on premises, which you can register behind the network
07:41 load balancer as an IP address.
07:44 And of course, your provider VPC and the on premise network needs to be connected over a VPN or direct
07:49 connect, something like this.
07:51 So you have only network load balancer here in AWS, but your actual target or services are running
07:59 in the on premises network.
08:00 So this is also very much, you know, valid architecture.
08:04 So just remember that.
08:07 Okay.
08:08 Enough said about the VPC endpoint service.
08:10 And now in the next lecture let's see that in action where we'll create our own VPC endpoint service.
08:16 And then we'll create VPC endpoint in the consumer VPC.
08:19 And we'll try to access those services right.
08:23 So with that we'll stop for this lecture.
08:24 And now let's go to the next lecture.
08:26 Thank you.
整讲总结 / Overall Summary
中文
本讲说明如何使用 VPC Endpoint Service 将 NLB 后的自建服务私有地发布给大量使用者 VPC，并避免 VPC Peering 的 CIDR 与广泛连通性限制。设计重点是跨 AZ 高可用部署、通过 zonal DNS 保持流量本地、跨账户按 AZ ID 对齐，以及允许 NLB 将经 VPN 或 AWS Direct Connect 可达的 on-premises 服务作为目标。
English
This lecture explains how VPC Endpoint Services privately publish NLB-backed customer services to large numbers of consumer VPCs without the CIDR and broad-connectivity constraints of VPC Peering. Key design points are multi-AZ high availability, using Zonal DNS to keep traffic local, aligning zones across accounts by AZ ID, and allowing NLB targets to be on-premises services reachable through VPN or AWS Direct Connect.
返回顶部 ↑